Fortinet Says Patch Now, Explain Later: Critical Fixes, No CVEs Until Nov. 10
Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently.
Fortinet has shipped fixes for critical and high-severity bugs in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, and is telling customers to upgrade now. The catch is that it won’t say what the bugs are until Nov. 10. In a blog post, CISO Carl Windsor says the flaws came out of an AI-assisted code review program. On Oct. 23, Australia’s ACSC put out a critical alert urging urgent patching, Cyber Daily reports.
For defenders
Status: No CVE IDs, CVSS scores or technical details have been published. Fortinet’s advisories are due on its PSIRT page on Nov. 10. Fortinet hasn’t said whether any of the bugs have been exploited, and ACSC says it isn’t aware of malicious activity. watchTowr’s Yordan Ganchev told Cyber Daily he expects the fixes to be reverse-engineered and exploited quickly. Fortinet makes the same point itself: attackers can diff the patched builds to find the vulnerable code.
| Product | Affected | Fixed |
|---|---|---|
| FortiOS | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, 7.2.0–7.2.13 | 8.0.2, 7.6.8, 7.4.13, 7.2.14 |
| FortiManager / FortiAnalyzer | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, 7.2.0–7.2.12 | 8.0.2, 7.6.8, 7.4.12, 7.2.13 |
| FortiMail | 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9 | 8.0.2, 7.6.7, 7.4.9; 7.2 users must move to 7.4+ |
| FortiAuthenticator | 8.0.0–8.0.3, 6.6.0–6.6.10 | 8.0.4, 6.6.11 |
If you can’t upgrade yet: Fortinet says to restrict HTTPS and SSH admin access to trusted IPs or turn it off on external interfaces, keep FortiManager off the internet, and enforce MFA on every admin account. It also says to watch logs for unexpected admin logins or config changes before and after you patch. Fortinet edge gear is already a favorite way in for attackers, as the k0t intrusions showed.
What it means for you
If your business has a FortiGate firewall or other Fortinet gear, it needs this update even though nobody has said publicly what’s broken. “Critical, details later” means the clock started when the patch came out: attackers can compare the old and new firmware to find the holes. If an IT provider manages your network, ask them whether it’s done.
Do this now
- List every Fortinet device you run, starting with anything reachable from the internet, and upgrade it to the fixed version in the table above.
- Back up each device’s configuration before upgrading.
- Until it’s patched, make sure the admin login page can’t be reached from the internet, and confirm every admin account has MFA.
- Check the Fortinet PSIRT page on Nov. 10 for the full advisories.